{"id":30424,"date":"2026-04-23T21:57:08","date_gmt":"2026-04-23T16:27:08","guid":{"rendered":"https:\/\/www.kaspersky.co.in\/blog\/?p=30424"},"modified":"2026-04-23T21:58:53","modified_gmt":"2026-04-23T16:28:53","slug":"income-tax-phishing-bait","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.in\/blog\/income-tax-phishing-bait\/30424\/","title":{"rendered":"Tax filings free from phishing, scams, or malware"},"content":{"rendered":"

In many countries, spring is the traditional time for filing income tax returns. These documents are a goldmine for bad actors<\/a> because they contain a wealth of personal data, such as employment history, income, assets, bank account details \u2014 the list goes on. It\u2019s no surprise that scammers ramp up their efforts around this time; the internet is currently crawling with fake websites designed to look exactly like government resources and tax authorities.<\/p>\n

With deadlines looming and numbers to crunch, the rush to get everything done in good time can cause people to let their guard down. In the shuffle, it\u2019s easy to miss the signs that the site where you\u2019re detailing your finances has zero connection to the revenue service, or that the file you just downloaded, supposedly from a tax inspector, is actually malware.<\/p>\n

In this post, we break down how these fraudulent tax agency sites operate across different countries and what you should absolutely avoid doing to keep your money and sensitive information safe.<\/p>\n

Taxpayer phishing<\/h2>\n

This season, attackers have been spoofing tax authority websites across numerous countries, including the official government portals of Germany, France, Austria, Switzerland, Brazil, Chile, and Colombia. On these fraudulent sites, scammers harvest credentials for legitimate services, and steal personal data before offering to process a tax deduction \u2014 provided the victim enters their credit card details. In some cases, they even charge a fee for this fraudulent service.<\/p>\n

\"Fraudulent<\/a>

A site imitating the Chilean tax authority. The victim is prompted to enter their credit card information to receive a substantial tax refund \u2014 roughly US$375. Instead, the funds are siphoned from the victim\u2019s account directly to the scammers<\/p><\/div>\n

Sometimes, the tactic involves accusations issued on behalf of government bodies. In the image below, for example, a \u201chead of tax audit\u201d in Paris informs the victim that they provided incomplete income information. To avoid penalties, the user is told to download a document and make corrections immediately. However, the PDF file hides something much worse: malware.<\/p>\n

\"Spoofed<\/a>

Instead of an official document from the French tax service, the user finds malware waiting inside the PDF<\/p><\/div>\n

In Colombia, a fake National Directorate of Taxes and Customs site similarly prompts users to download documents that must be \u201cunlocked with a security key\u201d. In reality, this is simply a password-protected, malicious ZIP archive.<\/p>\n

\"Fake<\/a>

After entering the password, the user opens a malicious archive that infects their device<\/p><\/div>\n

Beyond phishing sites mimicking legitimate resources, our experts have discovered fraudulent websites promising paid services for filling out and auditing tax documents \u2014 and stealing high-value data, such as taxpayer identification numbers (TINs), instead.<\/p>\n

\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\"\"\n\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\tScammers in Brazil offer help with tax returns. To contact them, the user must provide their name, phone number, address, date of birth, email, and TIN in a special form. Handing over a TIN puts the victim at risk of fraudulent loan applications, hijacked government service accounts, and further social engineering attacks\n\t\t\t\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t<\/dl>
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\"\"\n\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\tAnother Brazilian scam site. If you believe the attackers, they file 60 million tax returns annually \u2014 supposedly assisting a staggering 28% of the Brazilian population\n\t\t\t\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t<\/dl><\/div>\n

Tax-free crypto earnings<\/h2>\n

Cryptocurrency holders have emerged as a specific target for attackers. Fake German tax authorities are demanding that wallet owners \u201cverify their digital asset holdings\u201d, citing EU regulations for tax calculation purposes. And of course, there\u2019s a \u201csilver lining\u201d: it turns out crypto earnings are supposedly tax-exempt! However, to claim this generous benefit, users must go through a \u201cverification\u201d procedure. The site even promises to encrypt data using a \u201c2048-bit SSL protocol\u201d.<\/p>\n

To complete the \u201cverification\u201d process, users are prompted to enter their seed phrase\u00a0\u2014 the unique sequence of words tied to a crypto wallet that grants full recovery access. This request is paired with a threat: refusing to provide the data will lead to serious legal consequences, such as fines up to one million euros or criminal prosecution.<\/p>\n

\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\"\"\n\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\tAn announcement on the fake ELSTER portal claims that crypto earnings are tax-free following \"verification\" \u2014 and that the \"tax service\" has no direct access to users' wallets. Should we believe it? \n\t\t\t\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t<\/dl>
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\"\"\n\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\tFirst, the user is prompted to enter their personal information\u2026\n\t\t\t\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t<\/dl>
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\"\"\n\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\u2026And then they choose how to verify their crypto holdings: by linking a crypto wallet or an exchange account. Among the services targeted by these scammers are Ledger, Trezor, Trust Wallet, BitBox02, KeepKey, MetaMask, Phantom, and Coinbase\n\t\t\t\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t<\/dl>
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\"\"\n\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\tFinally, the victim is asked to provide their seed phrase, giving scammers total control over the wallet. The attackers kindly warn the victim to make sure no one is looking at their screen while they threaten them with non-existent legal penalties for non-compliance\n\t\t\t\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t<\/dl><\/div>\n

Attackers pulled a similar stunt on French users as well. They created a non-existent \u201cCrypto Tax Compliance Portal\u201d, which mimics the design of the French Ministry of Economy and Finance website. The phishing site aggressively demands that French residents submit a \u201cdigital asset declaration\u201d.<\/p>\n

After the user enters their personal information, the scammers prompt them to either manually enter their seed phrase, or \u201clink\u201d their crypto wallet to the portal. If they go through with this, their MetaMask, Binance, Coinbase, Trust Wallet, or WalletConnect wallets will be drained.<\/p>\n

\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\"\"\n\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\tThe phishing site aggressively demands that French residents provide a \"digital asset declaration\" (translation: they want to hijack your crypto accounts)\n\t\t\t\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t<\/dl>
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\"\"\n\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\tOnce personal data is entered, scammers offer the choice of manually entering a seed phrase or \"linking\" a wallet to the portal\n\t\t\t\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t<\/dl><\/div>\n

Can AI help with your tax returns?<\/h2>\n

When you have AI at your fingertips that can instantly generate text and fill out spreadsheets, there\u2019s a serious temptation to delegate everything to it. Unfortunately, this can lead to \u00a0serious consequences. First, all popular chatbots process your data on their servers, which puts your sensitive information at risk of a leak. Second, they sometimes make incredibly foolish mistakes, and that can lead to actual trouble with the taxman.<\/p>\n

Before you tell a chatbot or an AI agent how much money you made last year \u2014 complete with detailed personal and banking info \u2014 remember how frequently leaks occur within AI-powered services and consider the risks. Don\u2019t discuss your income with AI, don\u2019t give it personal details like your name or address, and under no circumstances should you upload photos or numbers of vital documents such as passports, insurance info, or social security numbers. Files containing confidential information should be kept in encrypted containers, such as Kaspersky Password Manager<\/a>.<\/p>\n

If you\u2019re still determined to use AI tools, run them locally. This can be done for free even on a standard laptop, and we\u2019ve previously covered how to set up local language models using DeepSeek as an example<\/a>. However, the quality of the output from these models is often subpar. It\u2019s quite possible that double-checking every digit in an AI-generated response will take more time than just filling out the paperwork manually. Remember, you\u2019re the one accountable to the tax office for any errors \u2014 not the AI.<\/p>\n

Finally, watch out for phishing AI models that offer \u201cassistance\u201d with tax filing. Kaspersky experts have discovered websites where users are prompted to upload tax invoices, supposedly for the automated generation of returns and deduction claims. Instead, attackers collect this personal data to resell on the dark web<\/a>, or to use in future phishing attacks, blackmail, and extortion<\/a> schemes.<\/p>\n

\"Phishing<\/a>

The creators of a fake AI tool prompt users to upload tax documents, and kindly assure them that the site doesn\u2019t store any user data. In reality, every piece of information entered \u2014 name, address, documents, contact person, phone number \u2014 ends up in the hands of cybercriminals<\/p><\/div>\n

Remember that all legitimate AI services explicitly warn users not to share confidential data, and tax documents certainly fall into this category. Any AI tools promising to help you handle your tax paperwork are quite simply a scam.<\/p>\n

How to protect yourself and your data<\/h2>\n